Google's Mandiant reports LLMjacking charges above $100,000 a day from stolen cloud and LLM credentials

TLDR

• Google reports LLMjacking charges above $100,000 in a day, and $1 million cumulatively at some organisations before revocation.¹²³
• Google says exposed or stolen cloud identity tokens were the dominant initial access vector, including service account keys.¹³
• Google says an actor made over 500,000 calls in under eight hours using stolen keys to power Jet Night.¹²³

Google's Mandiant and Google Threat Intelligence Group (GTIG) report that Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to large language models, a tactic known as LLMjacking.¹³ Google says the victims were in North America, South America and Asia Pacific, across financial services, retail, technology and transportation.¹ It says it observed fraudulent charges from resource consumption exceeding $100,000 in a single day across individual incidents, with cumulative charges at some organisations reaching $1 million before access was revoked.¹²³

Google says that across multiple LLMjacking investigations the dominant initial access vector was exposed or stolen cloud identity tokens, including IAM credentials, Service Account keys, GitHub personal access tokens and active session tokens.¹ In mid-2026, it says, UNC6993 compromised a cloud instance through a misconfigured Service Account key and used that access to grant further access to an LLM API.¹² UNC6993 also hosted a session hijacking page posing as an application portal for a group of LLM users, which asked visitors to paste a raw JSON payload containing an active access token, bypassing password and multifactor authentication controls.¹²³ In a separate case, Google says, a threat actor harvested exposed corporate LLM API keys from public GitHub repositories and checked them with single-token requests (max_tokens=1), which let the actor stay undetected by the victim's EDR and SIEM volume anomaly alerts.¹³

On the charges, Google says that after acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 in billing charges.¹ Another actor subscribed victim accounts to Pay-As-You-Go agreements, selected premium foundation models and launched high-volume inference streams, using a "burn and rotate" strategy of creating and deleting short-lived service accounts to bypass rate limits.¹² A further actor executed more than 500,000 LLM API calls in less than eight hours, using stolen third-party API keys to power the token routing service jet-night.com, which Google says passed nearly one million dollars in token costs to the victim organisation.¹³ GTIG believes Jet Night relies on stolen keys because its unlimited plan costs about $60 a month, against a typical $100 to $250 for a comparable consumer service.¹²³ The Register reports that Jet Night admitted to outages on its public Telegram channel, while Google's report says the service advertised outages there, which it likely attributes to stolen keys being revoked as victims discover the compromise.¹²

Google's recommended mitigations centre on identity and access management and supply chain security, including a centralised secrets management platform to rotate keys, least privilege that denies access to cloud LLM services where not required, and automated secret scanning of codebases.¹² It also lists granular API quotas and spending caps, API keys scoped by model endpoint and environment, phishing-resistant multifactor authentication, and monitoring of gateway and API logs for low-volume requests such as max_tokens=1 pings.¹ Because LLM services were not enabled at the time of compromise in multiple incidents, Google says any unauthorised enablement should be treated as a critical security event.¹³

Why it matters: in the cases Google describes, stolen or exposed keys and tokens were the main way in, and its guidance centres on secrets management, key scoping and spending caps rather than a patch.¹³